Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(transport): Integrate with enterprise certificate proxy (#1570)
Enterprise Certificate Proxy (https://github.com/googleapis/enterprise-certificate-proxy) is the new preferred solution for certificate based access on the client-side, since it integrates directly with the native OS keystores and does not expose the underlying private key. This new solution leverages the ECP client to replace the existing SecureConnect cert provider code-path for devices with the new ECP configuration file and helper binaries installed. (The ECP configuration file and helper binaries will eventually be distributed and managed through gCloud SDK). High-level change-list summary: - Refactored default_cert.go to split out SecureConnectSource into it's own file. - Added EnterpriseCertificateProxySource, a new client certificate source that uses the ECP client. - Updated tests and comments and added more test coverage. - Updated go.mod to include the new dependency. Note that this change is safe and backwards compatible, since the ECP configuration file will not be present on devices without ECP binaries installed, in which case the DefaultSource will fall back to using SecureConnect. Furthermore, both the new ECP code-path and the old SecureConnect code-path are gated behind the env-var GOOGLE_API_USE_CLIENT_CERTIFICATE today.
- Loading branch information
Showing
19 changed files
with
509 additions
and
211 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| // Copyright 2022 Google LLC. | ||
| // Use of this source code is governed by a BSD-style | ||
| // license that can be found in the LICENSE file. | ||
|
|
||
| // Package cert contains certificate tools for Google API clients. | ||
| // This package is intended to be used with crypto/tls.Config.GetClientCertificate. | ||
| // | ||
| // The certificates can be used to satisfy Google's Endpoint Validation. | ||
| // See https://cloud.google.com/endpoint-verification/docs/overview | ||
| // | ||
| // This package is not intended for use by end developers. Use the | ||
| // google.golang.org/api/option package to configure API clients. | ||
| package cert | ||
|
|
||
| import ( | ||
| "crypto/tls" | ||
| "errors" | ||
| "os" | ||
|
|
||
| "github.com/googleapis/enterprise-certificate-proxy/client" | ||
| ) | ||
|
|
||
| type ecpSource struct { | ||
| key *client.Key | ||
| } | ||
|
|
||
| // NewEnterpriseCertificateProxySource creates a certificate source | ||
| // using the Enterprise Certificate Proxy client, which delegates | ||
| // certifcate related operations to an OS-specific "signer binary" | ||
| // that communicates with the native keystore (ex. keychain on MacOS). | ||
| // | ||
| // The configFilePath points to a config file containing relevant parameters | ||
| // such as the certificate issuer and the location of the signer binary. | ||
| // If configFilePath is empty, the client will attempt to load the config from | ||
| // a well-known gcloud location. | ||
| func NewEnterpriseCertificateProxySource(configFilePath string) (Source, error) { | ||
| key, err := client.Cred(configFilePath) | ||
| if err != nil { | ||
| if errors.Is(err, os.ErrNotExist) { | ||
| // Config file missing means Enterprise Certificate Proxy is not supported. | ||
| return nil, errSourceUnavailable | ||
| } | ||
| return nil, err | ||
| } | ||
|
|
||
| return (&ecpSource{ | ||
| key: key, | ||
| }).getClientCertificate, nil | ||
| } | ||
|
|
||
| func (s *ecpSource) getClientCertificate(info *tls.CertificateRequestInfo) (*tls.Certificate, error) { | ||
| var cert tls.Certificate | ||
| cert.PrivateKey = s.key | ||
| cert.Certificate = s.key.CertificateChain() | ||
| return &cert, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| // Copyright 2022 Google LLC. | ||
| // Use of this source code is governed by a BSD-style | ||
| // license that can be found in the LICENSE file. | ||
| package cert | ||
|
|
||
| import ( | ||
| "errors" | ||
| "testing" | ||
| ) | ||
|
|
||
| func TestEnterpriseCertificateProxySource_ConfigMissing(t *testing.T) { | ||
| source, err := NewEnterpriseCertificateProxySource("missing.json") | ||
| if got, want := err, errSourceUnavailable; !errors.Is(err, errSourceUnavailable) { | ||
| t.Fatalf("NewEnterpriseCertificateProxySource: with missing config; got %v, want %v err", got, want) | ||
| } | ||
| if source != nil { | ||
| t.Errorf("NewEnterpriseCertificateProxySource: with missing config; got %v, want nil source", source) | ||
| } | ||
| } | ||
|
|
||
| // This test launches a mock signer binary "test_signer.go" that uses a valid pem file. | ||
| func TestEnterpriseCertificateProxySource_GetClientCertificateSuccess(t *testing.T) { | ||
| source, err := NewEnterpriseCertificateProxySource("testdata/enterprise_certificate_config.json") | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| cert, err := source(nil) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if cert.Certificate == nil { | ||
| t.Error("getClientCertificate: got nil, want non-nil Certificate") | ||
| } | ||
| if cert.PrivateKey == nil { | ||
| t.Error("getClientCertificate: got nil, want non-nil PrivateKey") | ||
| } | ||
| } | ||
|
|
||
| // This test launches a mock signer binary "test_signer.go" that uses an invalid pem file. | ||
| func TestEnterpriseCertificateProxySource_InitializationFailure(t *testing.T) { | ||
| _, err := NewEnterpriseCertificateProxySource("testdata/enterprise_certificate_config_invalid_pem.json") | ||
| if err == nil { | ||
| t.Error("NewEnterpriseCertificateProxySource: got nil, want non-nil err") | ||
| } | ||
| } |
Oops, something went wrong.